Analysis
-
max time kernel
120s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
19-12-2024 23:40
Behavioral task
behavioral1
Sample
367117f951c191f84db704c267e23b09f40bc9f28650a699113ce5b4d8c1be5fN.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
120 seconds
General
-
Target
367117f951c191f84db704c267e23b09f40bc9f28650a699113ce5b4d8c1be5fN.exe
-
Size
86KB
-
MD5
b36805db661243afe925d94ae9c76630
-
SHA1
3bcaae0542055fb95892764c8647d4d80da1292f
-
SHA256
367117f951c191f84db704c267e23b09f40bc9f28650a699113ce5b4d8c1be5f
-
SHA512
6539481703ebadc63c19d2f60135b45e64455f72fbe3d8ff20c920c8115cadc84e04e56f90b8271565db8da39518a4526e30f0f2c1993f9b524d5c8ffe18bf16
-
SSDEEP
1536:0vQBeOGtrYS3srx93UBWfwC6Ggnouy8CUYj7pcKN5Wy78uHDpFO:0hOmTsF93UYfwC6GIoutXZKmCXH9FO
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 56 IoCs
resource yara_rule behavioral1/memory/2280-7-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1708-27-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2188-17-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2908-60-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2668-78-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2644-69-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2684-86-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2764-51-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2880-50-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2880-47-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2448-36-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2684-93-0x0000000000430000-0x0000000000457000-memory.dmp family_blackmoon behavioral1/memory/2464-102-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1312-113-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1312-111-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2992-122-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/340-132-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1464-157-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1332-176-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2224-188-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1268-204-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1268-202-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2592-232-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1788-241-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1512-249-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/836-268-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2596-278-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2264-295-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1708-310-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2408-311-0x00000000003C0000-0x00000000003E7000-memory.dmp family_blackmoon behavioral1/memory/2748-324-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1564-338-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/1596-346-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2616-360-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2052-369-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2740-376-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1904-383-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2088-392-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2088-391-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1312-405-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/1312-406-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2120-498-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2120-518-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2440-587-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1600-612-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2932-626-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2652-657-0x00000000002D0000-0x00000000002F7000-memory.dmp family_blackmoon behavioral1/memory/2796-703-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2968-702-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/828-788-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/880-829-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2280-842-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3024-899-0x0000000000230000-0x0000000000257000-memory.dmp family_blackmoon behavioral1/memory/2020-1007-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1148-1021-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/544-1089-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2188 xblnrb.exe 1708 hbrvtp.exe 2448 djbhh.exe 2880 bjdvffj.exe 2764 fxtxtpl.exe 2908 jvvrjh.exe 2644 ltjtb.exe 2668 nvbblf.exe 2684 jxxvvn.exe 2464 pfprfx.exe 1312 htrvpjt.exe 2992 bffhn.exe 340 rbrfdj.exe 2860 tjhnp.exe 1948 vbnhrb.exe 1464 jddhjn.exe 3008 vtrnxh.exe 1332 jbjljjl.exe 1076 jvhxdv.exe 2224 lbtbn.exe 1268 nprxbjj.exe 2504 vvflxd.exe 1736 flvntpp.exe 2592 nbptt.exe 1788 plpvhl.exe 1512 jlrjvh.exe 932 vnvhpf.exe 836 vlbrrvh.exe 2596 vxhxb.exe 2408 bfrjlbp.exe 2264 dlvlv.exe 1988 rrpbrfv.exe 1708 jrflvnl.exe 868 thflvxn.exe 2748 hbrpx.exe 2892 njjbb.exe 1564 njvhpfb.exe 1596 rlbdpdf.exe 2772 xflht.exe 2616 pxbvh.exe 2052 xblnvjp.exe 2740 ptlvjd.exe 1904 rbdfbj.exe 2088 nfdrjtx.exe 656 jrtjx.exe 1312 xrhjtx.exe 1740 fthdp.exe 2836 hfplxh.exe 2968 hblhlnl.exe 2796 lnhfjx.exe 1932 bvlnfpx.exe 1884 tjvdnrr.exe 1752 dxnrj.exe 1504 trxhtnx.exe 2544 rftdp.exe 2288 xhrfltl.exe 2816 lbxtrj.exe 2224 tvbpx.exe 2392 fdvvjnr.exe 1184 vdblj.exe 2120 lntbnj.exe 2004 rrbjxb.exe 2592 fpnbpjf.exe 1488 dhdxdln.exe -
resource yara_rule behavioral1/memory/2280-1-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2280-7-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000a000000012262-5.dat upx behavioral1/memory/2188-9-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000900000001660b-20.dat upx behavioral1/files/0x0008000000016c23-28.dat upx behavioral1/memory/1708-27-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1708-19-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2188-17-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000016cab-39.dat upx behavioral1/memory/2880-38-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000016cd8-58.dat upx behavioral1/memory/2908-60-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000016ce9-75.dat upx behavioral1/memory/2668-78-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000194a3-85.dat upx behavioral1/memory/2644-69-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000016ce0-67.dat upx behavioral1/memory/2684-86-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2764-51-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000016ccc-48.dat upx behavioral1/memory/2880-47-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2448-36-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000194eb-94.dat upx behavioral1/files/0x00050000000194ef-103.dat upx behavioral1/memory/2464-102-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001950f-112.dat upx behavioral1/memory/1312-113-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1312-111-0x00000000001B0000-0x00000000001D7000-memory.dmp upx behavioral1/memory/2992-122-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019515-121.dat upx behavioral1/files/0x0005000000019547-134.dat upx behavioral1/memory/2860-133-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0009000000016ace-142.dat upx behavioral1/memory/340-132-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001957c-150.dat upx behavioral1/files/0x00050000000195a7-158.dat upx behavioral1/memory/1464-157-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000195ab-168.dat upx behavioral1/files/0x00050000000195ad-177.dat upx behavioral1/memory/1332-176-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2224-188-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000195af-186.dat upx behavioral1/files/0x00050000000195b1-194.dat upx behavioral1/files/0x00050000000195b3-205.dat upx behavioral1/memory/2504-206-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1268-204-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1268-202-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/files/0x00050000000195b5-215.dat upx behavioral1/files/0x00050000000195b7-224.dat upx behavioral1/memory/2592-232-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000195bb-231.dat upx behavioral1/files/0x00050000000195bd-242.dat upx behavioral1/files/0x00050000000195c1-250.dat upx behavioral1/memory/1512-249-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000195c3-259.dat upx behavioral1/memory/932-258-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/files/0x00050000000195c5-269.dat upx behavioral1/memory/836-268-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2596-270-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000195c6-280.dat upx behavioral1/files/0x00050000000195c7-287.dat upx behavioral1/memory/2596-278-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001960c-296.dat upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xnffn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jrptxrj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lnvxph.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nfpnf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lptpf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ftltp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ndjhnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ldbbxh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nrbtpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jrrbrvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nrxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvnjl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxbldd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rpbrld.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thxbfbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfjvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rntrnp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pxpvvbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xhplp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnlfd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pnvdn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvlnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jbltnj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frrfdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xtltb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bfplvhl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfvbbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bxjfv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pnrht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjblrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language njfbf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language njthfb.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2280 wrote to memory of 2188 2280 367117f951c191f84db704c267e23b09f40bc9f28650a699113ce5b4d8c1be5fN.exe 31 PID 2280 wrote to memory of 2188 2280 367117f951c191f84db704c267e23b09f40bc9f28650a699113ce5b4d8c1be5fN.exe 31 PID 2280 wrote to memory of 2188 2280 367117f951c191f84db704c267e23b09f40bc9f28650a699113ce5b4d8c1be5fN.exe 31 PID 2280 wrote to memory of 2188 2280 367117f951c191f84db704c267e23b09f40bc9f28650a699113ce5b4d8c1be5fN.exe 31 PID 2188 wrote to memory of 1708 2188 xblnrb.exe 32 PID 2188 wrote to memory of 1708 2188 xblnrb.exe 32 PID 2188 wrote to memory of 1708 2188 xblnrb.exe 32 PID 2188 wrote to memory of 1708 2188 xblnrb.exe 32 PID 1708 wrote to memory of 2448 1708 hbrvtp.exe 33 PID 1708 wrote to memory of 2448 1708 hbrvtp.exe 33 PID 1708 wrote to memory of 2448 1708 hbrvtp.exe 33 PID 1708 wrote to memory of 2448 1708 hbrvtp.exe 33 PID 2448 wrote to memory of 2880 2448 djbhh.exe 34 PID 2448 wrote to memory of 2880 2448 djbhh.exe 34 PID 2448 wrote to memory of 2880 2448 djbhh.exe 34 PID 2448 wrote to memory of 2880 2448 djbhh.exe 34 PID 2880 wrote to memory of 2764 2880 bjdvffj.exe 35 PID 2880 wrote to memory of 2764 2880 bjdvffj.exe 35 PID 2880 wrote to memory of 2764 2880 bjdvffj.exe 35 PID 2880 wrote to memory of 2764 2880 bjdvffj.exe 35 PID 2764 wrote to memory of 2908 2764 fxtxtpl.exe 36 PID 2764 wrote to memory of 2908 2764 fxtxtpl.exe 36 PID 2764 wrote to memory of 2908 2764 fxtxtpl.exe 36 PID 2764 wrote to memory of 2908 2764 fxtxtpl.exe 36 PID 2908 wrote to memory of 2644 2908 jvvrjh.exe 37 PID 2908 wrote to memory of 2644 2908 jvvrjh.exe 37 PID 2908 wrote to memory of 2644 2908 jvvrjh.exe 37 PID 2908 wrote to memory of 2644 2908 jvvrjh.exe 37 PID 2644 wrote to memory of 2668 2644 ltjtb.exe 38 PID 2644 wrote to memory of 2668 2644 ltjtb.exe 38 PID 2644 wrote to memory of 2668 2644 ltjtb.exe 38 PID 2644 wrote to memory of 2668 2644 ltjtb.exe 38 PID 2668 wrote to memory of 2684 2668 nvbblf.exe 39 PID 2668 wrote to memory of 2684 2668 nvbblf.exe 39 PID 2668 wrote to memory of 2684 2668 nvbblf.exe 39 PID 2668 wrote to memory of 2684 2668 nvbblf.exe 39 PID 2684 wrote to memory of 2464 2684 jxxvvn.exe 40 PID 2684 wrote to memory of 2464 2684 jxxvvn.exe 40 PID 2684 wrote to memory of 2464 2684 jxxvvn.exe 40 PID 2684 wrote to memory of 2464 2684 jxxvvn.exe 40 PID 2464 wrote to memory of 1312 2464 pfprfx.exe 41 PID 2464 wrote to memory of 1312 2464 pfprfx.exe 41 PID 2464 wrote to memory of 1312 2464 pfprfx.exe 41 PID 2464 wrote to memory of 1312 2464 pfprfx.exe 41 PID 1312 wrote to memory of 2992 1312 htrvpjt.exe 42 PID 1312 wrote to memory of 2992 1312 htrvpjt.exe 42 PID 1312 wrote to memory of 2992 1312 htrvpjt.exe 42 PID 1312 wrote to memory of 2992 1312 htrvpjt.exe 42 PID 2992 wrote to memory of 340 2992 bffhn.exe 43 PID 2992 wrote to memory of 340 2992 bffhn.exe 43 PID 2992 wrote to memory of 340 2992 bffhn.exe 43 PID 2992 wrote to memory of 340 2992 bffhn.exe 43 PID 340 wrote to memory of 2860 340 rbrfdj.exe 44 PID 340 wrote to memory of 2860 340 rbrfdj.exe 44 PID 340 wrote to memory of 2860 340 rbrfdj.exe 44 PID 340 wrote to memory of 2860 340 rbrfdj.exe 44 PID 2860 wrote to memory of 1948 2860 tjhnp.exe 45 PID 2860 wrote to memory of 1948 2860 tjhnp.exe 45 PID 2860 wrote to memory of 1948 2860 tjhnp.exe 45 PID 2860 wrote to memory of 1948 2860 tjhnp.exe 45 PID 1948 wrote to memory of 1464 1948 vbnhrb.exe 46 PID 1948 wrote to memory of 1464 1948 vbnhrb.exe 46 PID 1948 wrote to memory of 1464 1948 vbnhrb.exe 46 PID 1948 wrote to memory of 1464 1948 vbnhrb.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\367117f951c191f84db704c267e23b09f40bc9f28650a699113ce5b4d8c1be5fN.exe"C:\Users\Admin\AppData\Local\Temp\367117f951c191f84db704c267e23b09f40bc9f28650a699113ce5b4d8c1be5fN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2280 -
\??\c:\xblnrb.exec:\xblnrb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2188 -
\??\c:\hbrvtp.exec:\hbrvtp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1708 -
\??\c:\djbhh.exec:\djbhh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2448 -
\??\c:\bjdvffj.exec:\bjdvffj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
\??\c:\fxtxtpl.exec:\fxtxtpl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\jvvrjh.exec:\jvvrjh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
\??\c:\ltjtb.exec:\ltjtb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
\??\c:\nvbblf.exec:\nvbblf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
\??\c:\jxxvvn.exec:\jxxvvn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\pfprfx.exec:\pfprfx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2464 -
\??\c:\htrvpjt.exec:\htrvpjt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1312 -
\??\c:\bffhn.exec:\bffhn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2992 -
\??\c:\rbrfdj.exec:\rbrfdj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:340 -
\??\c:\tjhnp.exec:\tjhnp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
\??\c:\vbnhrb.exec:\vbnhrb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1948 -
\??\c:\jddhjn.exec:\jddhjn.exe17⤵
- Executes dropped EXE
PID:1464 -
\??\c:\vtrnxh.exec:\vtrnxh.exe18⤵
- Executes dropped EXE
PID:3008 -
\??\c:\jbjljjl.exec:\jbjljjl.exe19⤵
- Executes dropped EXE
PID:1332 -
\??\c:\jvhxdv.exec:\jvhxdv.exe20⤵
- Executes dropped EXE
PID:1076 -
\??\c:\lbtbn.exec:\lbtbn.exe21⤵
- Executes dropped EXE
PID:2224 -
\??\c:\nprxbjj.exec:\nprxbjj.exe22⤵
- Executes dropped EXE
PID:1268 -
\??\c:\vvflxd.exec:\vvflxd.exe23⤵
- Executes dropped EXE
PID:2504 -
\??\c:\flvntpp.exec:\flvntpp.exe24⤵
- Executes dropped EXE
PID:1736 -
\??\c:\nbptt.exec:\nbptt.exe25⤵
- Executes dropped EXE
PID:2592 -
\??\c:\plpvhl.exec:\plpvhl.exe26⤵
- Executes dropped EXE
PID:1788 -
\??\c:\jlrjvh.exec:\jlrjvh.exe27⤵
- Executes dropped EXE
PID:1512 -
\??\c:\vnvhpf.exec:\vnvhpf.exe28⤵
- Executes dropped EXE
PID:932 -
\??\c:\vlbrrvh.exec:\vlbrrvh.exe29⤵
- Executes dropped EXE
PID:836 -
\??\c:\vxhxb.exec:\vxhxb.exe30⤵
- Executes dropped EXE
PID:2596 -
\??\c:\bfrjlbp.exec:\bfrjlbp.exe31⤵
- Executes dropped EXE
PID:2408 -
\??\c:\dlvlv.exec:\dlvlv.exe32⤵
- Executes dropped EXE
PID:2264 -
\??\c:\rrpbrfv.exec:\rrpbrfv.exe33⤵
- Executes dropped EXE
PID:1988 -
\??\c:\jrflvnl.exec:\jrflvnl.exe34⤵
- Executes dropped EXE
PID:1708 -
\??\c:\thflvxn.exec:\thflvxn.exe35⤵
- Executes dropped EXE
PID:868 -
\??\c:\hbrpx.exec:\hbrpx.exe36⤵
- Executes dropped EXE
PID:2748 -
\??\c:\njjbb.exec:\njjbb.exe37⤵
- Executes dropped EXE
PID:2892 -
\??\c:\njvhpfb.exec:\njvhpfb.exe38⤵
- Executes dropped EXE
PID:1564 -
\??\c:\rlbdpdf.exec:\rlbdpdf.exe39⤵
- Executes dropped EXE
PID:1596 -
\??\c:\xflht.exec:\xflht.exe40⤵
- Executes dropped EXE
PID:2772 -
\??\c:\pxbvh.exec:\pxbvh.exe41⤵
- Executes dropped EXE
PID:2616 -
\??\c:\xblnvjp.exec:\xblnvjp.exe42⤵
- Executes dropped EXE
PID:2052 -
\??\c:\ptlvjd.exec:\ptlvjd.exe43⤵
- Executes dropped EXE
PID:2740 -
\??\c:\rbdfbj.exec:\rbdfbj.exe44⤵
- Executes dropped EXE
PID:1904 -
\??\c:\nfdrjtx.exec:\nfdrjtx.exe45⤵
- Executes dropped EXE
PID:2088 -
\??\c:\jrtjx.exec:\jrtjx.exe46⤵
- Executes dropped EXE
PID:656 -
\??\c:\xrhjtx.exec:\xrhjtx.exe47⤵
- Executes dropped EXE
PID:1312 -
\??\c:\fthdp.exec:\fthdp.exe48⤵
- Executes dropped EXE
PID:1740 -
\??\c:\hfplxh.exec:\hfplxh.exe49⤵
- Executes dropped EXE
PID:2836 -
\??\c:\hblhlnl.exec:\hblhlnl.exe50⤵
- Executes dropped EXE
PID:2968 -
\??\c:\lnhfjx.exec:\lnhfjx.exe51⤵
- Executes dropped EXE
PID:2796 -
\??\c:\bvlnfpx.exec:\bvlnfpx.exe52⤵
- Executes dropped EXE
PID:1932 -
\??\c:\tjvdnrr.exec:\tjvdnrr.exe53⤵
- Executes dropped EXE
PID:1884 -
\??\c:\dxnrj.exec:\dxnrj.exe54⤵
- Executes dropped EXE
PID:1752 -
\??\c:\trxhtnx.exec:\trxhtnx.exe55⤵
- Executes dropped EXE
PID:1504 -
\??\c:\rftdp.exec:\rftdp.exe56⤵
- Executes dropped EXE
PID:2544 -
\??\c:\xhrfltl.exec:\xhrfltl.exe57⤵
- Executes dropped EXE
PID:2288 -
\??\c:\lbxtrj.exec:\lbxtrj.exe58⤵
- Executes dropped EXE
PID:2816 -
\??\c:\tvbpx.exec:\tvbpx.exe59⤵
- Executes dropped EXE
PID:2224 -
\??\c:\fdvvjnr.exec:\fdvvjnr.exe60⤵
- Executes dropped EXE
PID:2392 -
\??\c:\vdblj.exec:\vdblj.exe61⤵
- Executes dropped EXE
PID:1184 -
\??\c:\lntbnj.exec:\lntbnj.exe62⤵
- Executes dropped EXE
PID:2120 -
\??\c:\rrbjxb.exec:\rrbjxb.exe63⤵
- Executes dropped EXE
PID:2004 -
\??\c:\fpnbpjf.exec:\fpnbpjf.exe64⤵
- Executes dropped EXE
PID:2592 -
\??\c:\dhdxdln.exec:\dhdxdln.exe65⤵
- Executes dropped EXE
PID:1488 -
\??\c:\fbvfbj.exec:\fbvfbj.exe66⤵PID:2580
-
\??\c:\hdxbjt.exec:\hdxbjt.exe67⤵PID:2044
-
\??\c:\bdbntj.exec:\bdbntj.exe68⤵PID:1412
-
\??\c:\fvfvxd.exec:\fvfvxd.exe69⤵PID:2488
-
\??\c:\bpbbd.exec:\bpbbd.exe70⤵PID:2320
-
\??\c:\rhhlrj.exec:\rhhlrj.exe71⤵PID:2332
-
\??\c:\rhnbpfj.exec:\rhnbpfj.exe72⤵PID:2596
-
\??\c:\ddxlnbn.exec:\ddxlnbn.exe73⤵PID:804
-
\??\c:\jlxftp.exec:\jlxftp.exe74⤵PID:2188
-
\??\c:\xfprt.exec:\xfprt.exe75⤵PID:2556
-
\??\c:\ndljld.exec:\ndljld.exe76⤵PID:2440
-
\??\c:\xhrjpr.exec:\xhrjpr.exe77⤵PID:2492
-
\??\c:\nfblxrd.exec:\nfblxrd.exe78⤵PID:2880
-
\??\c:\thbxbbd.exec:\thbxbbd.exe79⤵PID:2936
-
\??\c:\ttrnpdj.exec:\ttrnpdj.exe80⤵PID:1600
-
\??\c:\vrjxbt.exec:\vrjxbt.exe81⤵PID:2912
-
\??\c:\htxfpvd.exec:\htxfpvd.exe82⤵PID:2932
-
\??\c:\lrnxlb.exec:\lrnxlb.exe83⤵PID:2668
-
\??\c:\xxprbb.exec:\xxprbb.exe84⤵PID:2788
-
\??\c:\njthfb.exec:\njthfb.exe85⤵
- System Location Discovery: System Language Discovery
PID:2756 -
\??\c:\pbfbpnl.exec:\pbfbpnl.exe86⤵PID:320
-
\??\c:\pldlfj.exec:\pldlfj.exe87⤵PID:2652
-
\??\c:\bjxtvx.exec:\bjxtvx.exe88⤵PID:2080
-
\??\c:\hrbpv.exec:\hrbpv.exe89⤵PID:2844
-
\??\c:\xpjnnh.exec:\xpjnnh.exe90⤵PID:656
-
\??\c:\vlnldr.exec:\vlnldr.exe91⤵PID:2976
-
\??\c:\jndxnd.exec:\jndxnd.exe92⤵PID:384
-
\??\c:\xjbjvnh.exec:\xjbjvnh.exe93⤵PID:2852
-
\??\c:\xtltb.exec:\xtltb.exe94⤵
- System Location Discovery: System Language Discovery
PID:2968 -
\??\c:\xpnhdh.exec:\xpnhdh.exe95⤵PID:2796
-
\??\c:\hjhlrft.exec:\hjhlrft.exe96⤵PID:1460
-
\??\c:\jhfpff.exec:\jhfpff.exe97⤵PID:2716
-
\??\c:\dhtvnt.exec:\dhtvnt.exe98⤵PID:2096
-
\??\c:\ntdvnv.exec:\ntdvnv.exe99⤵PID:1812
-
\??\c:\jdpjx.exec:\jdpjx.exe100⤵PID:1156
-
\??\c:\thrdh.exec:\thrdh.exe101⤵PID:1520
-
\??\c:\pdjjnp.exec:\pdjjnp.exe102⤵PID:1164
-
\??\c:\fbvnrd.exec:\fbvnrd.exe103⤵PID:972
-
\??\c:\xbbdhf.exec:\xbbdhf.exe104⤵PID:328
-
\??\c:\ffxvnf.exec:\ffxvnf.exe105⤵PID:968
-
\??\c:\lfhjvjr.exec:\lfhjvjr.exe106⤵PID:1744
-
\??\c:\rxxfbpp.exec:\rxxfbpp.exe107⤵PID:1060
-
\??\c:\rbrdn.exec:\rbrdn.exe108⤵PID:828
-
\??\c:\rppph.exec:\rppph.exe109⤵PID:1788
-
\??\c:\frvxn.exec:\frvxn.exe110⤵PID:3064
-
\??\c:\dbjnv.exec:\dbjnv.exe111⤵PID:2212
-
\??\c:\ldbbxh.exec:\ldbbxh.exe112⤵
- System Location Discovery: System Language Discovery
PID:2180 -
\??\c:\dnvdfjj.exec:\dnvdfjj.exe113⤵PID:568
-
\??\c:\tlpjx.exec:\tlpjx.exe114⤵PID:880
-
\??\c:\rtrlb.exec:\rtrlb.exe115⤵PID:2700
-
\??\c:\fphjv.exec:\fphjv.exe116⤵PID:2280
-
\??\c:\fxhpx.exec:\fxhpx.exe117⤵PID:2000
-
\??\c:\rthhjl.exec:\rthhjl.exe118⤵PID:2200
-
\??\c:\lplxh.exec:\lplxh.exe119⤵PID:2432
-
\??\c:\drhvltl.exec:\drhvltl.exe120⤵PID:2036
-
\??\c:\vbjbn.exec:\vbjbn.exe121⤵PID:2892
-
\??\c:\hxbpjvr.exec:\hxbpjvr.exe122⤵PID:3036
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-